A enterprise healthcare provider relies on a software-as-a-service (SaaS) vendor for managing patient scheduling. The vendor provided a SOC 2 Type II attestation report covering the twelve-month period ending September 30. However, the healthcare provider's annual compliance audit occurs on December 31, resulting in a three-month gap between the vendor's audit end date and the healthcare provider's fiscal year end. Which of the following documents should the vendor provide to confirm that no material changes affected the control environment during this gap period?
- A bridge letter signed by vendor management attesting that controls remained effectiveCevap
- BA SOC 2 Type I report evaluating control design as of December 31
- CA SOC 3 report summarizing security performance for the entire calendar year
- DAn Attestation of Compliance (AoC) issued by an independent audit firm
Cevap
A bridge letter signed by vendor management attesting that controls remained effective
A bridge letter (also called a gap letter) is provided by vendor management to cover the interim period between the end of a SOC audit reporting period and the client's fiscal year end. It confirms that the internal control environment has not undergone material changes and that controls continue to operate effectively.
Adım Adım Çözüm
Anahtar Kavram
Bridge Letters (Gap Letters) in Third-Party Attestation
Tahmini Süre:1m 15s